From: Jes Sorensen Date: Sat, 26 Apr 2014 16:54:49 +0000 (+0200) Subject: staging: rtl8723au: Check kmalloc return value and fix size of memcpy() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=5bd28bc2e4748d828a03dabd6122f004e31b9e98;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git staging: rtl8723au: Check kmalloc return value and fix size of memcpy() Check kmalloc() return before dereferencing bssid in rtw_check_bcn_info23a() and use the correct size to copy rtw_basic_rate_ofdm in update_bmc_sta_support_rate23a() Reported-by: Dan Carpenter Signed-off-by: Jes Sorensen Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c index 68991dca1cbf..3a729a0a85b5 100644 --- a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c @@ -4510,7 +4510,7 @@ u8 collect_bss_info23a(struct rtw_adapter *padapter, } ie_offset -= offsetof(struct ieee80211_mgmt, u); - bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + length; + bssid->Length = offsetof(struct wlan_bssid_ex, IEs) + length; /* below is to copy the information element */ bssid->IELength = length; diff --git a/drivers/staging/rtl8723au/core/rtw_wlan_util.c b/drivers/staging/rtl8723au/core/rtw_wlan_util.c index 646e468a630d..f2d77123cbc0 100644 --- a/drivers/staging/rtl8723au/core/rtw_wlan_util.c +++ b/drivers/staging/rtl8723au/core/rtw_wlan_util.c @@ -899,15 +899,17 @@ int rtw_check_bcn_info23a(struct rtw_adapter *Adapter, } bssid = (struct wlan_bssid_ex *)kzalloc(sizeof(struct wlan_bssid_ex), - GFP_ATOMIC); + GFP_ATOMIC); + if (!bssid) + return _FAIL; bssid->reserved = 1; - bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len; + bssid->Length = offsetof(struct wlan_bssid_ex, IEs) + len; /* below is to copy the information element */ bssid->IELength = len; - memcpy(bssid->IEs, &mgmt->u, bssid->IELength); + memcpy(bssid->IEs, &mgmt->u, len); /* check bw and channel offset */ /* parsing HT_CAP_IE */ @@ -1589,9 +1591,11 @@ void update_bmc_sta_support_rate23a(struct rtw_adapter *padapter, u32 mac_id) if (pmlmeext->cur_wireless_mode & WIRELESS_11B) { /* Only B, B/G, and B/G/N AP could use CCK rate */ - memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_cck, 4); + memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), + rtw_basic_rate_cck, 4); } else { - memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_ofdm, 4); + memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), + rtw_basic_rate_ofdm, 3); } }